CVE-2025-1750
CVE-2025-1750 · SQL Injection in run-llama/llama_index
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE).
CVSS 9.8 · Critical · EPSS 0.9% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
run-llama/llama_index
- Versions
- ≥ unspecified, < 0.3.1: Affected (custom)
Update to 0.3.1
llama-index-vector-stores-duckdb PyPI
- Affected ranges
- ECOSYSTEM: ≥ 0.12.19, < 0.12.21
Update to 0.12.21
llama-index PyPI
- Versions
- 0.12.19
- 0.12.20
- Affected ranges
- ECOSYSTEM: ≥ 0.12.19, < 0.12.21
Update to 0.12.21